Read the docs
TI-2026-20857 Aliases CVE-2026-25793GHSA-69x3-g4r3-p962

Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability

Priority LOW 32CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00143 3rd percentileScored 2026-11-07
Fix Fixed nebula (slackhq): 1.10.3github.com/slackhq/nebula (Go): 1.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
slackhqnebula1.7.0 to before 1.10.31.10.3Patch availableCNA
—github.com/slackhq/nebula (Go)1.7.0 to before 1.10.31.10.3Patch availableGHSA-69x3-g4r3-p962
  • nebula Vendorslackhq Affected 1.7.0 to before 1.10.3 Fixed in 1.10.3 Patch available CNA
  • github.com/slackhq/nebula (Go) Vendor— Affected 1.7.0 to before 1.10.3 Fixed in 1.10.3 Patch available GHSA-69x3-g4r3-p962

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:slack:nebula:*:*:*:*:*:*:*:*1.7.0 to before 1.10.3VulnerableSlack
  • cpe:2.3:a:slack:nebula:*:*:*:*:*:*:*:* Versions 1.7.0 to before 1.10.3 Vulnerable ·Slack

Remediation

  • Fix · CNA nebula (slackhq) Fixed in 1.10.3
  • Fix · GHSA-69x3-g4r3-p962 github.com/slackhq/nebula (Go) Fixed in 1.10.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25793
  2. 2026-10-03 Alias added: GHSA-69x3-g4r3-p962

References

Patch 1

Advisory 2

Other 1

  • TI-2020-09222 Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences